Blue Screen of Death after update. RRS feed

  • Question

  • I have recently updated windows to creator update but after update I'm getting blue screen of death. The stop code is Unexpected Store Exception. The programs I mostly used are WAMP, VSCode, Chrome, Edge, Node.js, Angular CLI etc. I have installed new windows a week or two weeks ago. Here is the memory dump file

    • Edited by Mohsini172 Sunday, May 20, 2018 6:10 PM
    Sunday, May 20, 2018 6:03 PM

All replies

  • That's just an .evtx but it looks like you have a problem with Bitlocker.

    This is the BSOD

    The computer has rebooted from a bugcheck.  The bugcheck was: 0x00000154 (0xffffc409cf126000, 0xfffff580e9491090, 0x0000000000000002, 0x0000000000000000). A dump was saved in: C:\WINDOWS\MEMORY.DMP. Report Id: 6fd6a08c-b9d9-45e8-8068-59dce94e15d0.

    You would need the dump to get more info.

    FWIW I would focus on the Bitlocker symptom first.

    Robert Aldwinckle

    Sunday, May 20, 2018 6:27 PM
  • The MEMORY.DMP is not there windows folder. Should I enable memory dumps from somewhere?
    Sunday, May 20, 2018 6:35 PM
  • here's the mini dump file I have found

    Sunday, May 20, 2018 7:35 PM
  • here's the mini dump file I have found

    Sunday, May 20, 2018 7:36 PM
  • To evaluate the BSOD please post logs for troubleshooting.

    Using administrative command prompt copy and paste this whole command:

    Make sure the default language is English so that the logs can be scanned and read.

    The command will automatically collect the computer files and place them on the desktop.

    Then use one drive or drop box to place share links into the thread for troubleshooting.

    This command will automatically collect these files:  msinfo32, mini dumps, drivers, hosts, install, uninstall, services, startup, event viewer files, etc.

    Open administrative command prompt and copy and paste the whole command:

    copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\"&dxdiag /t %Temp%\dxdiag.txt&copy %Temp%\dxdiag.txt "%USERPROFILE%\Desktop\SFdebugFiles\"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\systeminfo.txt"&driverquery /v > "%USERPROFILE%\Desktop\drivers.txt" &msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\installed.txt"&net start > "%USERPROFILE%\Desktop\services.txt"&REM wmic startup list full /format:htable >"%USERPROFILE%\Desktop\startup.html"&wmic STARTUP GET Caption, Command, User >"%USERPROFILE%\Desktop\startup.txt"

    There are two files for you to find manually:  memory dump file:


    Use file explorer > this PC > local C: drive > right upper corner search enter each of the above to find results.

    Dxdiag:   In the left lower corner search type:  dxdiag > When the DirectX Diagnostic Tool opens click on the next page button so that each tab is opened > click on save all information > save to desktop > post one drive or drop box share link into the thread



    .Please remember to vote and to mark the replies as answers if they help.




    Sunday, May 20, 2018 9:58 PM
  • Hi,

    According to your dump file, the crashes most probably caused by memory corruption.

    Use !analyze -v to get detailed debugging information.
    BugCheck 1A, {6001, ffffffffc0000185, 3970000, ffff80088252f010}
    *** WARNING: Unable to verify timestamp for win32k.sys
    *** ERROR: Module load completed but symbols could not be loaded for win32k.sys
    Probably caused by : memory_corruption ( nt!MmStoreProbeAndLockPages+147 )

    If you are over-clocking, reset anything to default.

    Afterwards, do the following two tests:

    1. Driver verifier

    2. Memtest

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact

    Monday, May 21, 2018 6:58 AM
  • here's the mini dump file I have found

    Good.  We can try to find a clue from the BSOD parameter data using LM on that dump.



    Oh.  This is a different dump?  different bugcheck?

    Use !analyze -v to get detailed debugging information.
    BugCheck 1A, {6001, ffffffffc0000185, 3970000, ffff80088252f010}


    WIN8?  Is my DMP program too old?

    ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

    The 6001 is another "Other" 

    I still don't see a fit for either of those addresses.

    Looks like as usual we need someone who has access to current source or support documentation to help diagnose with these clues (or better debugging and reverse engineering skills than I have).

    Robert Aldwinckle

    Monday, May 21, 2018 4:03 PM